Certificate Pool

In addition to the Built-In CA →, which issues certificates itself, Relution supports certificate authorities of the type Certificate pool. In this case an existing, external PKI serves as the source: the certificates issued there are imported into Relution as an archive and kept as a pool. Whenever a certificate is required for a configuration, it is assigned from this pool instead of being generated.

Create a certificate authority of the type Certificate pool #

The authority is created under Settings → Certificate Authorities → Add. In the Authority type drop-down menu, the entry Certificate pool is selected. This type is only available in regular organizations, not in the global organization or a meta organization.

Mandatory fields

• Name: Name of the certificate authority in Relution.

Details related to certificate issuance — such as a password for the root certificate, a common name or an expiration date — are not required, because a certificate pool does not sign certificates itself.

Import certificates into the pool #

The import is performed by editing the previously saved certificate authority; the Import certificate pool field only appears after the authority has been saved for the first time. There, a ZIP archive containing the externally issued certificate files is uploaded. Below it, Relution lists the certificates already contained in the pool.

Optionally, a subtype can be set in the Default certificate subtype field. It determines the function for which the certificates are available later on. The available options are the same functions as for user certificates: General certificate, WiFi, Exchange, VPN and apps, S/MIME Encryption and S/MIME Signing (see User certificates →). If a subtype is selected, it applies to all certificates in the archive; the #Zertifikatstyp column of the CSV file is then ignored and may be omitted. With the default setting None, the subtype is taken from the #Zertifikatstyp column row by row; rows without a valid subtype are reported as errors.

Structure of the archive #

The ZIP archive contains the externally issued certificate files as well as exactly one CSV file (UTF-8) that specifies an identifier and the import password for each certificate. Accepted certificate files are PKCS#12 containers (.p12 or .pfx) and PEM files (.pem with private key, certificate and certificate chain). The separator is a semicolon, the header row is:

#E-Mail-Adresse;#P12-Passwort;#Zertifikatstyp

The columns are mapped via the header row, so their order does not matter. One row per certificate, for example:

#E-Mail-Adresse;#P12-Passwort;#Zertifikatstyp
max.mustermann@example.com;secretPassword;WIFI

The CSV row and the certificate file are matched by file name: the certificate file in the archive is named after the identifier in the #E-Mail-Adresse column, in this example max.mustermann@example.com.p12. If the file name differs from the identifier, the certificate cannot be matched. Certificate files without a corresponding CSV row are ignored.

After the upload, the form shows the result: the number of imported certificates, skipped duplicates and errors. The affected identifiers are listed under Failed imports. Faulty rows do not abort the import; the remaining certificates are imported nonetheless. A certificate counts as a duplicate if its serial number already exists in the pool of the organization.

Imported certificates in the certificate management #

The imported certificates then appear under Settings → Certificates with the usage Built-in pool certificate, each with the subtype selected during the import or specified in the CSV file — WiFi in the case described here. This view allows the certificates to be inspected and managed like all other stored certificates, see Certificate Management →.

Certificate template for a certificate pool #

So that the certificates from the pool can be used in policy configurations, a template is created under Settings → Certificate Templates → Add.

If a certificate pool is selected as the certificate authority, the fields for certificate generation are omitted (Subject name, Subject alternative names, Key algorithm, Key length, Certificate key usages, Certificate extended key usages). The following are displayed:

• Name: Name of the template.
• Certificate template type and Description (optional).
• Certificate Authority: The previously created certificate authority of the type Certificate pool.
• Enable automatic renewal with Automatic renewal period (in days): If the expiration date of an assigned certificate falls within this period, it is replaced by a free certificate of the same subtype from the pool. The previous certificate is marked as deleted and is not assigned again.
• Certificate renewal behaviour and Period after which the certificate expires (in days) (mandatory, default value 365).

The required subtype results from the configuration in which the template is used, e.g. WiFi for a Wi-Fi configuration. If the pool no longer contains a free certificate of this subtype, no certificate can be assigned and Relution reports a compliance violation; the pool then has to be replenished with further certificates. If only a renewal is due, the previous certificate remains assigned until it expires, and Relution creates a compliance notice.

Validation #

The setup is complete once

• the certificate authority of the type Certificate pool has been created,
• the import of the ZIP archive (in the example with the subtype WiFi) has completed without duplicates and without errors,
• the imported certificates are listed under Settings → Certificates with the subtype WiFi, and
• the certificate template for the certificate pool authority is displayed without any fields for certificate generation, but with the renewal and expiration options.

Using the template in a policy follows the same procedure as with the Built-In CA, see Built-In CA →.